UCF STIG Viewer Logo

The rhttpproxy must produce log records containing sufficient information to establish the source of events.


Overview

Finding ID Version Rule ID IA Controls Severity
V-240720 VCRP-67-000005 SV-240720r679673_rule Medium
Description
After a security incident has occurred, investigators will often review log files to determine what happened, and determining the source of an event is crucial for forensics. The rhttpproxy must be configured for verbose logging to capture client IP addresses and the associated actions.
STIG Date
VMware vSphere 6.7 RhttpProxy Security Technical Implementation Guide 2022-01-03

Details

Check Text ( C-43953r679671_chk )
At the command prompt, execute the following command:

# xmllint --xpath '/config/log/level' /etc/vmware-rhttpproxy/config.xml

Expected result:

verbose

If the output does not match the expected result, this is a finding.
Fix Text (F-43912r679672_fix)
Navigate to and open /etc/vmware-rhttpproxy/config.xml.

Locate the / block and configure as follows:

verbose

Restart the service for changes to take effect.

# vmon-cli --restart rhttpproxy